Detections
Analytics
SCA: security update for org.opensearch.plugin:opensearch-security (GHSA-f4qr-f4xx-hjxw)
high Tenable Self-Hosted Container Security Plugin ID 414260
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization.
Versions 2.0.0.0 and 2.1.0.0 of the security plugin are affected by an information disclosure
vulnerability. Requests to an OpenSearch cluster configured with advanced access control features document
level security (DLS), field level security (FLS), and/or field masking will not be filtered when the
query's search pattern matches an aliased index. OpenSearch Dashboards creates an alias to `.kibana` by
default, so filters with the index pattern of `*` to restrict access to documents or fields will not be
applied. This issue allows requests to access sensitive information when customer have acted to restrict
access that specific information. OpenSearch 2.2.0, which is compatible with OpenSearch Security 2.2.0.0,
contains the fix for this issue. There is no recommended work around. (CVE-2022-35980)
See Also
Plugin Details
Severity: High
ID: 414260
Version: Revision 1.6
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.18
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N
CVSS Score Source: CVE-2022-35980
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 8/12/2022
Vulnerability Publication Date: 8/12/2022
Reference Information
CVE: CVE-2022-35980
cwe: CWE-612